oss-sec mailing list archives

CVE request: kernel: x86: Fix broken LDT access in VMI


From: Eugene Teo <eteo () redhat com>
Date: Fri, 03 Oct 2008 16:55:53 +0800

This was committed in upstream kernel recently.

"[PATCH] x86: Fix broken LDT access in VMI

After investigating a JRE failure, I found this bug was introduced a
long time ago, and had already managed to survive another bugfix which
occurred on the same line.  The result is a total failure of the JRE due
to LDT selectors not working properly.

This one took a long time to rear up because LDT usage is not very
common, but the bug is quite serious.  It got introduced along with
another bug, already fixed, by 75b8bb3e56ca09a467fbbe5229bc68627f7445be"

This requires a CVE name. In a guest, an unprivileged user can trash the
box's interrupts by calling vmi_write_ldt_entry(), which in turn, writes
to idt_entry (interrupt) instead of ldt_entry (local). Take note that
sys_modify_ldt() does not check for privileges.

Upstream commit: de59985e3a623d4d5d6207f1777398ca0606ab1c
Introduced by: 75b8bb3e56ca09a467fbbe5229bc68627f7445be

Thanks, Eugene


Current thread: